How to change EAP type and inner authentication
Hello, I'm using both hostapd and freeradius. I was wondering if you could tell me how to change EAP type and inner authentication. Thank you. Regards, Luca
On Fri, Apr 07, 2017 at 09:38:50AM +0000, LUCA wrote:
I'm using both hostapd and freeradius. I was wondering if you could tell me how to change EAP type and inner authentication.
You configure it on the end user device. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Sure, but should be configured also on the server side. Supported EAP methods (integrated EAP server and RADIUS authentication server) in hostapd: * EAP-TLS * EAP-PEAP/MSCHAPv2 (both PEAPv0 and PEAPv1) * EAP-PEAP/TLS (both PEAPv0 and PEAPv1) * EAP-PEAP/GTC (both PEAPv0 and PEAPv1) * EAP-PEAP/MD5-Challenge (both PEAPv0 and PEAPv1) * EAP-TTLS/EAP-MD5-Challenge * EAP-TTLS/EAP-GTC * EAP-TTLS/EAP-MSCHAPv2 * EAP-TTLS/MSCHAPv2 * EAP-TTLS/EAP-TLS * EAP-TTLS/MSCHAP * EAP-TTLS/PAP * EAP-TTLS/CHAP * EAP-SIM * EAP-AKA * EAP-AKA' * EAP-PAX * EAP-PSK * EAP-SAKE * EAP-FAST * EAP-IKEv2 * EAP-GPSK I just don't know how to switch to one of these methods. Luca ________________________________ From: Freeradius-Users <freeradius-users-bounces+sfire=hotmail.it@lists.freeradius.org> on behalf of Matthew Newton <mcn4@leicester.ac.uk> Sent: Friday, April 7, 2017 12:45 PM To: FreeRadius users mailing list Subject: Re: How to change EAP type and inner authentication On Fri, Apr 07, 2017 at 09:38:50AM +0000, LUCA wrote:
I'm using both hostapd and freeradius. I was wondering if you could tell me how to change EAP type and inner authentication.
You configure it on the end user device. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html FreeRADIUS -- users' list info<http://www.freeradius.org/list/users.html> www.freeradius.org Users' List Information. The freeradius-users mailing list is for users of the FreeRADIUS server not Cistron's server! There are a few house-rules to which we'd like ...
On Apr 7, 2017, at 8:03 AM, LUCA <sfire@hotmail.it> wrote:
Sure, but should be configured also on the server side.
So... you're arguing with the people who know more than you?
Supported EAP methods (integrated EAP server and RADIUS authentication server) in hostapd:
This is the FreeRADIUS list. Not the hostap list. If you have hostap questions, ask them how their software works.
I just don't know how to switch to one of these methods.
Matthew told you, and you didn't believe him. Since you obviously know better than everyone here, I suggest you use that expertise to solve the problem yourself. Alan DeKok.
On Fri, Apr 07, 2017 at 12:03:04PM +0000, LUCA wrote:
Sure, but should be configured also on the server side.
Of course. But you asked how you change it. As it's the client that chooses what sort of EAP method to use, you therefore configure it on the client.
I just don't know how to switch to one of these methods.
As I said before, you configure it on the end user device. That will switch the authentication to whatever you have configured. Obviously you also have to configure FreeRADIUS for whichever method you choose. The default install works for a wide range of EAP methods by default. See what's in mods-enabled/eap. But ultimately no matter how many methods you configure on FreeRADIUS, it's the end device which chooses which one to use. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
I see, so it's always the supplicant to choose which one EAP method to use. Any workaround to force the client to choose one specific method? Thank you. Luca ________________________________ From: Freeradius-Users <freeradius-users-bounces+sfire=hotmail.it@lists.freeradius.org> on behalf of Matthew Newton <mcn4@leicester.ac.uk> Sent: Friday, April 7, 2017 3:31 PM To: FreeRadius users mailing list Subject: Re: How to change EAP type and inner authentication On Fri, Apr 07, 2017 at 12:03:04PM +0000, LUCA wrote:
Sure, but should be configured also on the server side.
Of course. But you asked how you change it. As it's the client that chooses what sort of EAP method to use, you therefore configure it on the client.
I just don't know how to switch to one of these methods.
As I said before, you configure it on the end user device. That will switch the authentication to whatever you have configured. Obviously you also have to configure FreeRADIUS for whichever method you choose. The default install works for a wide range of EAP methods by default. See what's in mods-enabled/eap. But ultimately no matter how many methods you configure on FreeRADIUS, it's the end device which chooses which one to use. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html FreeRADIUS -- users' list info<http://www.freeradius.org/list/users.html> www.freeradius.org Users' List Information. The freeradius-users mailing list is for users of the FreeRADIUS server not Cistron's server! There are a few house-rules to which we'd like ...
On Fri, Apr 07, 2017 at 02:48:33PM +0000, LUCA wrote:
I see, so it's always the supplicant to choose which one EAP method to use. Any workaround to force the client to choose one specific method?
Usually, remove the server configs for all the other methods, then none of those will work. You can also set the default EAP method, but clients will generally just ignore that and tell the server what they want to do anyway. By setting the default EAP method you just save one round trip for clients that are already going to use that method. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Very well, thank you very much for the suggestion. I'm going to set the default EAP method and inner authentication. In the meanwhile, may I ask you how can I exactly remove all the other methods? Which configs should I remove exactly? Luca ________________________________ From: Freeradius-Users <freeradius-users-bounces+sfire=hotmail.it@lists.freeradius.org> on behalf of Matthew Newton <mcn4@leicester.ac.uk> Sent: Friday, April 7, 2017 4:52 PM To: FreeRadius users mailing list Subject: Re: How to change EAP type and inner authentication On Fri, Apr 07, 2017 at 02:48:33PM +0000, LUCA wrote:
I see, so it's always the supplicant to choose which one EAP method to use. Any workaround to force the client to choose one specific method?
Usually, remove the server configs for all the other methods, then none of those will work. You can also set the default EAP method, but clients will generally just ignore that and tell the server what they want to do anyway. By setting the default EAP method you just save one round trip for clients that are already going to use that method. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
LUCA -
Matthew Newton